CVE-2026-1786
Last modified
CVE-2026-1786 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. The Twitter posts to Blog plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'dg_tw_options' function in all versions up to, and including, 1.11.25. This makes it possible for unauthenticated attackers to update plugin settings including Twitter API credentials, post author, post status, and the capability required to access the plugin's admin menu.. EPSS estimates a 0.28% chance of exploitation in the next 30 days.
Description
The Twitter posts to Blog plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'dg_tw_options' function in all versions up to, and including, 1.11.25. This makes it possible for unauthenticated attackers to update plugin settings including Twitter API credentials, post author, post status, and the capability required to access the plugin's admin menu.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-1786?
How severe is CVE-2026-1786?
How do I fix CVE-2026-1786?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-17854Insufficient policy enforcement in WebMCP in Google Chrome p…6.5
- CVE-2026-17855Race in DevTools in Google Chrome on Mac prior to 151.0.7922…9.6
- CVE-2026-17856Inappropriate implementation in Network in Google Chrome on …9.6
- CVE-2026-17857Inappropriate implementation in Network in Google Chrome pri…4.3
- CVE-2026-17858Uninitialized Use in WebNN in Google Chrome on Windows prior…4.3
- CVE-2026-17859Inappropriate implementation in Favicons in Google Chrome pr…4.3
- CVE-2026-17860Insufficient validation of untrusted input in Mobile in Goog…3.3
- CVE-2026-17861Insufficient validation of untrusted input in Updater in Goo…7.8
- CVE-2026-17862Use after free in Tracing in Google Chrome on Windows prior …7.8
- CVE-2026-17863Inappropriate implementation in Browser in Google Chrome on …7.8
- CVE-2026-17864Inappropriate implementation in Updater in Google Chrome on …7.8
- CVE-2026-17865Inappropriate implementation in Crypto in Google Chrome on M…9.6
Are you affected by CVE-2026-1786?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST